CVE-2025-25467

CriticalRCE

Published: 18 February 2025

Published

18 February 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0018 39.8th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-25467 is a critical-severity Code Injection (CWE-94) vulnerability in Videolan (inferred from references). Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 39.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-25467 is a critical memory management vulnerability in the libx264 git master branch, an open-source H.264 video encoding library. The issue stems from insufficient tracking and releasing of allocated used memory, classified under CWE-94 (Improper Control of Generation of Code). Published on 2025-02-18, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for complete system compromise.

Remote attackers require no privileges or user interaction to exploit this flaw. By creating a specially crafted AAC file and inducing a victim to process it through an application using the vulnerable libx264 git master—such as a media player or video encoder—the attacker can trigger the memory handling defect, leading to arbitrary code execution on the target system.

Mitigation details are available in the upstream issue tracker at https://code.videolan.org/videolan/x264/-/issues/75, where practitioners should check for patches or workarounds applicable to affected builds.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-4692

Vulnerability details

Insufficient tracking and releasing of allocated used memory in libx264 git master allows attackers to execute arbitrary code via creating a crafted AAC file.

CWE(s): CWE-94

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution

Adversaries may exploit software vulnerabilities in client applications to execute code.

attack.mitre.org →

Why these techniques?

The vulnerability enables remote arbitrary code execution via a crafted AAC file processed by client applications (e.g., media players or video encoders) using libx264, directly mapping to T1203: Exploitation for Client Execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0